PT-2019-2344 · Cisco · Cisco Industrial Network Director

Published 2019-06-05 · Updated 2020-10-16 · CVE-2019-1861

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Industrial Network Director (affected versions not specified)

Description The issue is related to insufficient input validation in the software update feature. This could allow a remote attacker to execute arbitrary code by uploading a specially crafted file. The attacker must have administrator privileges to exploit this issue. The vulnerability is due to improper validation of uploaded files.

Recommendations For all affected versions, consider restricting access to the software update feature until a fix is available. As a temporary workaround, restrict file uploads to only necessary and trusted sources. Avoid using administrator privileges for routine operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-20

CWE-434

Related Identifiers

BDU:2019-02119

CVE-2019-1861

Affected Products

Cisco Industrial Network Director

References · 6

• https://osv.dev/vulnerability/CVE-2019-1861 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190605-ind-rce · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02119 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1861 · Security Note
• http://securityfocus.com/bid/108622 · Note
• https://securityfocus.com/bid/108622 · Note